--- title: Medium | daily.dev description: A wire-level security analysis revealed that xAI's Grok Build CLI was silently uploading entire git repositories — including full commit history and unredacted... canonical: https://daily.dev/posts/medium-dhelurz55 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Medium | daily.dev og:description: A wire-level security analysis revealed that xAI's Grok Build CLI was silently uploading entire git repositories — including full commit history and unredacted... og:url: https://daily.dev/posts/medium-dhelurz55 og:image: https://api.daily.dev/og/posts/DHelurz55.png og:image:alt: Medium og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Medium **[Medium](https://daily.dev/sources/medium_js)** · 16 min read · 0 upvotes · 0 comments ## Summary A wire-level security analysis revealed that xAI's Grok Build CLI was silently uploading entire git repositories — including full commit history and unredacted secrets — to a Google Cloud Storage bucket called `grok-code-session-traces`. For a task requiring only ~192 KB of context, the tool transmitted 5.1 GB in the background via a separate storage channel undocumented in any onboarding material. Disabling the 'Improve the model' toggle did not stop the uploads. A canary file explicitly excluded from the AI prompt was still included in the upload bundle. xAI responded publicly on July 13, 2026, noting Zero Data Retention (ZDR) for enterprise users and a `/privacy` command for others, but issued no formal CVE or security advisory. The post recommends rotating any credentials exposed in affected repos and provides a detailed technical guide for auditing AI CLI tools via mitmproxy, egress allowlisting, eBPF monitoring, git secret scanning, and container isolation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#ai-coding](https://daily.dev/tags/ai-coding), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/medium-dhelurz55) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Medium","url":"https://daily.dev/posts/medium-dhelurz55","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/medium-dhelurz55"},"datePublished":"2026-07-20T21:09:16.098Z","dateModified":"2026-07-20T21:09:56.708Z","description":"A wire-level security analysis revealed that xAI's Grok Build CLI was silently uploading entire git repositories — including full commit history and unredacted...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5e940ca21d3b3b05c968feae67c93e70?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5e940ca21d3b3b05c968feae67c93e70?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/medium-dhelurz55","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-coding,secrets-management","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Medium"}]} ```